The Unethical Engineer's Guide to Event Ticket Acquisition

The Unethical Engineer's Guide to Event Ticket Acquisition

Speakers: Karl Koscher

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=wXbnUm88IJw

Overview

In "The Unethical Engineer's Guide to Event Ticket Acquisition," Karl Koscher delivers a thought-provoking and technically rich presentation on the various sophisticated methods that could be employed to bypass the anti-bot measures of high-demand event ticketing systems, specifically using the ShmooCon conference as a case study. The talk delves into a "trifecta of techniques," ranging from network-layer manipulation to advanced artificial intelligence and distributed human computation, demonstrating the ongoing arms race between event organizers and those seeking to game the system.

Koscher, while emphasizing that none of the described attacks were used for personal gain and that he legitimately acquired his tickets, frames the discussion as a hypothetical exploration of vulnerabilities. The presentation is particularly relevant to the ShmooCon audience, many of whom are intimately familiar with the intense, F5-refresh-driven scramble for tickets that often sell out in mere seconds. This talk not only exposes potential weaknesses but also provides valuable insights into the complexity of building truly resilient ticketing infrastructure in an environment increasingly challenged by automated exploitation.

The importance of this talk extends beyond the specific context of ShmooCon. It serves as a critical reminder for any organization managing high-demand online resources – be it conference tickets, concert passes, or limited-edition product drops – that sophisticated attackers will leverage every available vector. Koscher's research highlights the need for multi-layered defenses, from fundamental network security to advanced bot detection and even re-evaluating core ticketing philosophies, to ensure fair access and prevent exploitation.

Background

▶ Watch: Introduction: Bypassing ShmooCon anti-bot measures (0:00)

The annual ShmooCon conference is renowned for its intimate size and high demand, creating a notoriously difficult ticket acquisition process. ShmooCon explicitly limits its attendance and prioritizes bringing in "fresh blood" rather than simply expanding, a philosophy detailed in their "Own the Con" talk. This intentional scarcity leads to a frantic ticketing event where tickets typically sell out in under seven seconds, often leaving many hopeful attendees disappointed.

The core problem stems from the sheer volume of users simultaneously attempting to access a limited resource. The traditional ShmooCon ticketing process involves a multi-stage challenge designed to deter bots. Initially, users must refresh a landing page until a secret URL for the actual ticket sales appears. Clicking this link leads to a second page featuring a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), which must be solved correctly. Upon successful CAPTCHA submission, users are granted a brief window (historically, five minutes) to enter their email address and secure a reservation before proceeding to a third, secure site for payment.

Historically, a significant vulnerability in this process was the lack of HTTPS (Hypertext Transfer Protocol Secure) on the initial landing and CAPTCHA pages. While the final payment portal was secure, the preceding steps transmitted critical URLs in clear text. This architectural decision, made in part to prioritize speed, inadvertently exposed potential attack vectors. The entire system is hosted on AWS (Amazon Web Services), meaning these unencrypted communications would traverse cloud infrastructure, making them susceptible to observation by privileged network users or even those with a strategically positioned vantage point. Understanding this multi-stage, clear-text, and time-sensitive process forms the foundation for the attack techniques explored in the talk.

Key Findings

▶ Watch: ShmooCon site architecture and cleartext URL exposure (3:59)

Karl Koscher's talk revealed three primary techniques that could be used by an "unethical engineer" to bypass ShmooCon's anti-bot measures and gain an unfair advantage in ticket acquisition. These findings demonstrate the diverse attack surface presented by modern online ticketing systems, encompassing network infrastructure, client-side automation, and even distributed human computation.

Firstly, Koscher detailed a BGP (Border Gateway Protocol) hijack scenario. This sophisticated network-level attack could redirect traffic intended for the ShmooCon ticketing server to an attacker-controlled server, effectively intercepting ticket requests before they even reached the legitimate system. This finding highlighted a fundamental vulnerability in routing security that, while not specific to ShmooCon, could impact any AWS-hosted service.

Secondly, the talk showcased an innovative application of local Large Language Models (LLMs) to solve CAPTCHAs in real-time. Koscher developed a Chrome extension that leverages a compact, browser-based LLM to automatically read and solve ShmooCon's text-based CAPTCHAs with remarkable speed. This demonstrated that even seemingly complex human verification steps can be automated with modern AI, achieving solve times as low as 1.3 to 1.5 seconds, significantly faster than typical human response.

Finally, Koscher presented the concept of a crowdsourced CAPTCHA solving botnet. This technique involves a second Chrome extension designed to broadcast valid ticket links and CAPTCHA solutions among a group of users via a WebSocket chat server. The core idea is to leverage the collective speed of multiple human participants, or even a mix of humans and automated solvers, to ensure that at least one member of the "botnet" secures a ticket, sharing the solution with others for immediate exploitation. These findings collectively illustrate that ticket acquisition is not merely a client-side problem, but a multi-faceted challenge requiring robust defenses across the entire stack.

Technical Deep Dive

▶ Watch: BGP hijacking: Stealing tickets via network route manipulation (5:00)

The technical depth of Koscher's presentation spanned three distinct areas: network-level routing manipulation, client-side AI automation, and distributed human-machine collaboration.

The first technique, URL observation and BGP hijacking, leveraged historical architectural details. The ShmooCon ticketing system was initially split across three sites: a landing page, a CAPTCHA page, and a reservation page, with the first two often lacking HTTPS. This meant the "secret URLs" for the CAPTCHA and reservation pages were transmitted in cleartext. An attacker with privileged network access, or even positioned "anywhere in between," could observe this traffic, extract the URLs, and navigate directly to the subsequent stages, bypassing the initial F5 scramble. Koscher noted that the system was hosted on AWS, making it susceptible to broader network attacks.

A more advanced variant of this involved a BGP hijack. Koscher pointed out that the 44/10 IP address range, historically designated for amateur radio and experimentation, was purchased by AWS for $108 million (approximately $25 per IP address). One year, the ShmooCon ticket server resided within this 44.0.0.0/10 block. An attacker could exploit this by announcing a more specific route, such as a /24 subnet, for the specific IP address of ticks.shmoocon.org. This BGP announcement, if accepted by upstream providers, would redirect traffic for the ShmooCon ticket server to an attacker-controlled server. This is not a theoretical attack; a real-world incident in 2022 saw cryptocurrency stolen using precisely this method, demonstrating its practical feasibility and severe implications. An attacker could then serve their own CAPTCHA page, capture user data, or simply forward the legitimate link to themselves, securing tickets.

The second core technique involved building a local LLM-based CAPTCHA solver. Koscher developed a Chrome extension designed to run an LLM directly in the browser to solve text-based CAPTCHAs. This was made possible by projects like Web LLM and MLC LLM, which are forked from the Apache TVM project. These frameworks compile large language models into WebAssembly that can leverage WebGPU for local execution within a browser environment.

For model selection, Koscher required a small, fast model that wouldn't refuse "weird tasks" like CAPTCHA solving (e.g., Llama 3.1 in more accurate modes might decline). He chose a Microsoft model with approximately 3.5 billion parameters and a small context window, further quantized to reduce its memory footprint and increase speed on consumer hardware. The system prompt provided to the LLM was concise: "You are a large language model that solves text captchas provided by the user. The solution to the captcha is always a single word. Limit your response to one word." This setup enabled the LLM to solve CAPTCHAs in approximately 1.3 seconds during a live demonstration and around 1.5 seconds against a sample of seven previous ShmooCon captchas.

Finally, Koscher introduced the concept of a crowdsourced CAPTCHA solver, essentially a distributed "botnet" of human users. This involved a second Chrome extension that would observe browser navigation. If a user landed on a page that appeared to be a valid CAPTCHA or a solution to one, the extension would broadcast this information (the valid link or the solved CAPTCHA) to a group of friends or collaborators via a simple WebSocket chat server. The goal is to leverage the collective speed and processing power of multiple individuals or automated agents. Even if one person is slow, another might be fast, ensuring that the critical information (the secret URL or the CAPTCHA answer) is quickly propagated among the group, allowing multiple individuals to secure tickets simultaneously.

Demo / Proof of Concept

▶ Watch: Live demo: AI solves captcha in 1.3 seconds (8:00)

Karl Koscher's presentation included two compelling live demonstrations that vividly illustrated the feasibility and speed of his proposed attack techniques. These demos were particularly impactful, earning praise from the judges for their execution under pressure.

The first demonstration showcased the local LLM-based CAPTCHA solver. Koscher set up a split-screen scenario, contrasting the speed of his automated solver against a humorous benchmark: Sam Ray Redacted's son, who is playfully cited as having the fastest recorded time in any Olympic event in 2,700 years. As Sam began his ascent in the video, Koscher clicked on a simulated ShmooCon ticket link, triggering the Chrome extension. The LLM processed the CAPTCHA and displayed the correct answer in approximately 1.3 seconds, a speed that far outstripped human capability. This live proof of concept effectively demonstrated that modern, locally run AI could overcome a common anti-bot measure with unprecedented efficiency.

The second demonstration involved the crowdsourced CAPTCHA solving botnet. Koscher presented a QR code to the audience, inviting them to participate (with a humorous warning not to actually scan it). The setup involved a simulated ShmooCon page with a new, fake link. When Koscher navigated to this page and clicked the link, the crowdsourcing Chrome extension was activated. The premise was that any audience member who had scanned the QR code and participated would have their browser observe the navigation, identify the valid link or solution, and broadcast it to others via the WebSocket server. While the full multi-user interaction wasn't explicitly shown in detail due to the live environment, the demonstration effectively conveyed the concept: a distributed network of users (or bots) could share critical, time-sensitive information to collectively game the system. This highlighted the power of collective intelligence, whether human or artificial, in bypassing security controls. The successful execution of these live demos underscored the practical relevance of Koscher's research and the immediate threat posed by such techniques.

Defensive Implications

▶ Watch: AI successfully solves all tested ShmooCon captchas (9:15)

The "Unethical Engineer's Guide" provides critical insights for defenders aiming to secure high-demand ticketing systems. Koscher's research underscores that security is an ongoing arms race and requires a multi-layered approach.

First and foremost, the historical vulnerability of cleartext URL transmission highlights the absolute necessity of HTTPS Everywhere. Encrypting all traffic from the initial landing page to the final payment portal prevents passive observation of secret URLs, mitigating both simple sniffing attacks and more sophisticated BGP hijack scenarios that might attempt to capture unencrypted data. While ShmooCon has moved towards improved HTTPS adoption, the talk serves as a reminder that this must be a default, not an optional, security feature.

Regarding BGP hijacking, defending against this requires broader industry collaboration and robust BGP routing security practices. Implementing RPKI (Resource Public Key Infrastructure) and advocating for BGPsec can help validate route origins and prevent unauthorized route announcements. While individual event organizers may not directly control global BGP routing, working with their cloud providers (like AWS) to ensure their allocated IP space is properly secured and validated is crucial.

The rise of AI-powered CAPTCHA solvers necessitates a re-evaluation of CAPTCHA design. Simple text-based CAPTCHAs are increasingly vulnerable. Defenders must explore more complex, interactive, or context-aware CAPTCHAs that are difficult for current LLMs to solve quickly. Koscher playfully suggested "play Doom on nightmare mode and kill at least three monsters" as a hypothetical harder CAPTCHA. However, he also acknowledged that even advanced visual or interactive challenges could eventually be overcome by AI (e.g., aimbots for gaming). This points to the need for continuous innovation in anti-bot measures, potentially leveraging behavioral analytics, device fingerprinting, or other forms of probabilistic bot detection rather than relying solely on a single challenge. Defenders could also consider intentional random waits in their response times to disrupt timing analysis that attackers might use to detect clustered, bot-like requests.

Finally, the talk touched on alternative ticketing models. While ShmooCon explicitly avoids a Ticketmaster-like system that might prioritize previous attendees or verified fans, other events could consider such approaches for managing demand. The ferry reservation system mentioned (randomizing early birds but vulnerable to multiple browser sessions) highlights that even seemingly fair systems can be gamed. ShmooCon's commitment to "fresh blood" means they must continually innovate their anti-bot measures without resorting to preferential treatment.

Ultimately, Koscher commended ShmooCon for doing a "hard problem well," and notably, he engaged in coordinated vulnerability disclosure rather than dropping a zero-day. This emphasizes that responsible security research, even when exploring "unethical" methods, is a critical component of improving overall defense postures. The lesson for defenders is to anticipate increasingly sophisticated attacks, continuously adapt their security measures, and collaborate with security researchers.

Key Takeaways

• Sophisticated Attack Vectors: Bypassing anti-bot measures for high-demand event tickets can involve a diverse array of techniques, from network-level BGP hijacks to client-side AI automation and crowdsourced human efforts.
• AI's Impact on CAPTCHAs: Modern, locally run Large Language Models (LLMs) can solve traditional text-based CAPTCHAs with remarkable speed (e.g., 1.3-1.5 seconds), rendering simple CAPTCHAs increasingly ineffective against automated attacks.
• Network Security Fundamentals Matter: Cleartext transmission of critical URLs and vulnerabilities in BGP routing can expose ticketing systems to fundamental network attacks, highlighting the importance of ubiquitous HTTPS and robust BGP security practices.
• The Arms Race Continues: As defenders implement new anti-bot measures, attackers will continuously develop new methods to circumvent them, necessitating constant innovation and adaptation in security strategies.
• Crowdsourcing as an Attack Vector: Distributed human or human-machine networks can be leveraged to share time-sensitive solutions (like CAPTCHA answers or secret URLs), effectively creating a "botnet" that pools resources for collective advantage.
• Responsible Disclosure is Key: Even when exploring "unethical" engineering practices, responsible vulnerability disclosure (as practiced by the speaker) is crucial for helping organizations strengthen their defenses before exploitation occurs.

About the Speaker(s)

Karl Koscher is the speaker behind "The Unethical Engineer's Guide to Event Ticket Acquisition." Based on his presentation, he is a security researcher and engineer with expertise in network security, web technologies, and artificial intelligence. While not explicitly stating his professional affiliation during the talk, he made a clear disclaimer that his views and the content presented do not necessarily represent his employer. His work demonstrates a deep understanding of both offensive and defensive security strategies, particularly in the context of online systems and anti-bot measures.